{
  "label": "Fictional retained D2 result. Synthetic draft; not issued.",
  "source": "prototype/verification/poc-ontology-05-proof-20260915.json.gz",
  "source_sha256": "be615e5b60683ab42740970ec096eaebddfa753f550fdf443b20c0a3cda6951b",
  "proof_id": "9deb74aa81ae992eed66812e45c87826b5511fadba6a71f703fe4b3ab5958fca",
  "case_id": "case-a31e38ea14a0",
  "run_id": "risk-run-bd1b55121121",
  "run_at": "2026-09-15T13:03:39.462236Z",
  "release_status": "held",
  "review": {
    "basis": "Scripted synthetic rubric exercise, not a professional adjudication or measured reviewer session.",
    "identity_verified": false,
    "independent": false,
    "professional_review_minutes": null
  },
  "result": {
    "boundary": {
      "assumptions": [
        "Supplied system inventory bounds this unit; omitted enterprise systems are not examined.",
        "Fictional source authority is stipulated, not independently authenticated."
      ],
      "period": {
        "end": "2026-07-01T00:00:00Z",
        "start": "2026-06-01T00:00:00Z"
      },
      "population": [
        "worker-17",
        "worker-24",
        "worker-33"
      ],
      "population_reconciled": true,
      "reachable_scope": [
        "Retained customer exports"
      ],
      "systems": [
        "archive-prod"
      ]
    },
    "checks": [
      {
        "check_id": "D2.population",
        "detail": "Reconciled 3 unit departures against a separately originated roster.",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-HR:D2-ROSTER"
        ],
        "label": "Population",
        "record_ids": [
          "POP-01",
          "D2-ROSTER"
        ],
        "status": "supported"
      },
      {
        "check_id": "D2.central",
        "detail": "Central disablement took 15 minutes; criterion 4 hours.",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH"
        ],
        "label": "LEAVE-17 central",
        "record_ids": [
          "LEAVE-17",
          "C-ID-02",
          "POP-01",
          "D2-ARCH"
        ],
        "status": "supported",
        "subject_id": "LEAVE-17"
      },
      {
        "check_id": "D2.archive",
        "detail": "An application withdrawal action on archive-prod occurred after the allowed deadline.",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH"
        ],
        "label": "LEAVE-17 archive",
        "record_ids": [
          "LEAVE-17",
          "C-ID-02",
          "POP-01",
          "D2-ARCH"
        ],
        "status": "exception",
        "subject_id": "LEAVE-17"
      },
      {
        "check_id": "D2.central",
        "detail": "Central disablement took 10 minutes; criterion 4 hours.",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-24",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH"
        ],
        "label": "LEAVE-24 central",
        "record_ids": [
          "LEAVE-24",
          "C-ID-02",
          "POP-01",
          "D2-ARCH"
        ],
        "status": "supported",
        "subject_id": "LEAVE-24"
      },
      {
        "check_id": "D2.archive",
        "detail": "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-24",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH"
        ],
        "label": "LEAVE-24 archive",
        "record_ids": [
          "LEAVE-24",
          "C-ID-02",
          "POP-01",
          "D2-ARCH"
        ],
        "status": "supported",
        "subject_id": "LEAVE-24"
      },
      {
        "check_id": "D2.central",
        "detail": "Central disablement took 12 minutes; criterion 4 hours.",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-33",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH"
        ],
        "label": "LEAVE-33 central",
        "record_ids": [
          "LEAVE-33",
          "C-ID-02",
          "POP-01",
          "D2-ARCH"
        ],
        "status": "supported",
        "subject_id": "LEAVE-33"
      },
      {
        "check_id": "D2.archive",
        "detail": "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-33",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH"
        ],
        "label": "LEAVE-33 archive",
        "record_ids": [
          "LEAVE-33",
          "C-ID-02",
          "POP-01",
          "D2-ARCH"
        ],
        "status": "supported",
        "subject_id": "LEAVE-33"
      }
    ],
    "evidence_model": {
      "authority": "Original fictional sources; hashes establish identity, not authenticity or completeness.",
      "basis_id": "e7830fa6e02d8dbc74c31134a6358c1156af1b1a94d803b32db83cb352ec35c0",
      "id": "79041b79305b13b3fb5f7c46622e23b58fffb28589e1803e8f6a924378d7f453",
      "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
      "passages": [
        {
          "collection": "complete_for_unit",
          "id": "3ac16c7193cf0a5898a20a93c0a8195ed4eb3608aad45a8c956a577aebdb88dd",
          "locator": "ORG-03",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "SRC-01",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use."
          ],
          "record_id": "ORG-03",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:SRC-01:ORG-03",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "function": "Retained customer exports",
            "id": "ORG-03",
            "owner": "Customer operations",
            "resource": "archive-prod",
            "sensitive": true
          },
          "value_hash": "961cf3ce6c4e5bd4c6a91014059c357e9e9719866a21512aad13ad1f214a0279"
        },
        {
          "collection": "selected_extract",
          "id": "c132a2449b8c44541ef8900052c1de390435dc8c24bb1d8e4124e0e4d1bfdae3",
          "locator": "R-DATA",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "SRC-02",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use."
          ],
          "record_id": "R-DATA",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:SRC-02:R-DATA",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "assumptions": [
              "Central identity governs all workforce access",
              "Departures lose access across stores",
              "Exposed credentials are contained"
            ],
            "controls": [
              "C-ID-01",
              "C-ID-02",
              "C-KEY-01"
            ],
            "id": "R-DATA",
            "owner": "Security leader",
            "rating": "Critical",
            "title": "Unauthorized disclosure of customer case files"
          },
          "value_hash": "646c894a1328a584ae1df9e24d424717742f72e324c804b6bc55fb8ec31815d7"
        },
        {
          "collection": "named_relationships",
          "id": "6a7d044208ce6b8b7598f30341e54036398d636cdcbd9b86511cc4a951189d4c",
          "locator": "INT-03",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "SRC-04",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use."
          ],
          "record_id": "INT-03",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:SRC-04:INT-03",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "account_owner": "Customer operations",
            "automated_lifecycle": false,
            "id": "INT-03",
            "resource": "archive-prod"
          },
          "value_hash": "234f2fe6062bd01a47d9793fa55ac833a7cd0192ef4ffb7325039580ef4210c2"
        },
        {
          "collection": "available",
          "id": "9bde415d3dfb8e18747a06ea2910066b428e63abd52f62a7c40214b50aa77bc0",
          "locator": "C-ID-02",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-03",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "C-ID-02",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "claimed_status": "IT workflow complete",
            "hours": 4,
            "id": "C-ID-02",
            "requirement": "Remove central, application-local and session access within four hours of departure."
          },
          "value_hash": "a4b6bcd16d0113cd55d156d59786947c2909844d5dfeb67a4082e8da4407f326"
        },
        {
          "collection": "available",
          "id": "e0bbdc9a91a38e7ec2bfb03f37442ef25bcde3a13590e2ae16508617e18fd5a6",
          "locator": "POP-01",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-09",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "POP-01",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "automated_resources": [
              "central-directory",
              "intake-prod administration"
            ],
            "complete": true,
            "id": "POP-01",
            "members": [
              "worker-17",
              "worker-24",
              "worker-33"
            ]
          },
          "value_hash": "d215de6af343d924f6a7765c3fed1573ad901f04fd6a3ed5df6285714682fa60"
        },
        {
          "collection": "available",
          "id": "b8f52dc302637ec8575305a699ee9a0b866c211f6ea826dbab3dc861b2e1923c",
          "locator": "LEAVE-17",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-09",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "LEAVE-17",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "account": "archive-u17",
            "actor": "archive-u17",
            "allowed_read_at": null,
            "archive_disabled_at": "2026-06-07T09:25:00Z",
            "central_disabled_at": "2026-06-05T09:15:00Z",
            "departed_at": "2026-06-05T09:00:00Z",
            "id": "LEAVE-17",
            "resource": "archive-prod",
            "sessions_revoked_at": "2026-06-05T09:25:00Z",
            "subject": "worker-17",
            "ticket_closed_at": "2026-06-05T09:20:00Z"
          },
          "value_hash": "b167b0a6039e716e1feca8dd53854f62c4f03ebb470f05008d1ccacc1af06091"
        },
        {
          "collection": "available",
          "id": "6903037fb54dd9b68d32160c27652575690e8d1c2dedadc21a1922c618bf7849",
          "locator": "LEAVE-24",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-09",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "LEAVE-24",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-24",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "account": "archive-u24",
            "allowed_read_at": null,
            "archive_disabled_at": "2026-06-07T09:25:00Z",
            "central_disabled_at": "2026-06-07T09:10:00Z",
            "departed_at": "2026-06-07T09:00:00Z",
            "id": "LEAVE-24",
            "resource": "archive-prod",
            "sessions_revoked_at": "2026-06-07T09:25:00Z",
            "subject": "worker-24",
            "ticket_closed_at": "2026-06-07T09:30:00Z"
          },
          "value_hash": "16e82cff426e0d9a5a32ec52067ad66e1a024d4437e0ce0ea6f14da4b0165260"
        },
        {
          "collection": "available",
          "id": "4dbe910fa844e79602250e2b502b5cf3e8a45090d9fd1c0d9eed97133819c0bb",
          "locator": "LEAVE-33",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-09",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "LEAVE-33",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-33",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "account": "archive-u33",
            "allowed_read_at": null,
            "archive_disabled_at": "2026-06-09T09:25:00Z",
            "central_disabled_at": "2026-06-09T09:12:00Z",
            "current_disabled": true,
            "departed_at": "2026-06-09T09:00:00Z",
            "id": "LEAVE-33",
            "resource": "archive-prod",
            "sessions_revoked_at": "2026-06-09T09:25:00Z",
            "subject": "worker-33",
            "ticket_closed_at": "2026-06-09T09:20:00Z"
          },
          "value_hash": "ebacf9cec9aee0bb15572d00d3e84862f8d513076334a8b2857fbc53a6766850"
        },
        {
          "collection": "available",
          "id": "511f9eaaa91c4384347d99868795f41b219378d35b41b383f7596dc0d141f63e",
          "locator": "D2-ARCH",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-D2-ARCH",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "D2-ARCH",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "id": "D2-ARCH",
            "systems": [
              {
                "reachable": "Retained customer exports",
                "resource": "archive-prod",
                "withdrawal": "automated"
              }
            ]
          },
          "value_hash": "3c4e13d8d486464d9683d52db53d9a76f6fca6b2230d4a59c1e597f2f35a5488"
        },
        {
          "collection": "available",
          "id": "5d76a5067525db993b46229fbfdedb76fe5028e06fa213e135213019b5fa1893",
          "locator": "D2-ROSTER",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-D2-HR",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "D2-ROSTER",
          "source_ref": "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-HR:D2-ROSTER",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "complete": true,
            "id": "D2-ROSTER",
            "members": [
              "worker-17",
              "worker-24",
              "worker-33"
            ],
            "period": {
              "end": "2026-07-01T00:00:00Z",
              "start": "2026-06-01T00:00:00Z"
            }
          },
          "value_hash": "d203182832120f5f8bece6f73f937485a7d76b72120813a26afced45115ca18c"
        },
        {
          "collection": "available",
          "id": "90763f5784ae42badc53d323dfc70995345f09ed2973d566a96faa7f1883cbf4",
          "locator": "LEAVE-17",
          "observed_at": "2026-09-15T12:36:43.298Z",
          "origin": "CAPTURE-SRC-09",
          "qualifications": [
            "Original fictional records; authority/coverage stipulated for this unit. Event timestamps and stated limitations govern historical use.",
            "Locally supplied fictional browser capture. Source declarations are stipulated, not independently authenticated.",
            "http://127.0.0.1:8778/d2-table.html captured 2026-09-15T12:36:43.298Z",
            "Rendered normal-flow fields on this scrollable page only; hidden, clipped, positioned or transformed content, frames and unvisited pages are omitted.",
            "Only UTC date filters and the reviewed fictional system names are retained; unsafe or unavailable filters are null.",
            "Source declarations are fictional and unverified. URL query, fragment and credentials were excluded."
          ],
          "record_id": "LEAVE-17",
          "source_ref": "case-a31e38ea14a0:d5cc544553f28771:CAPTURE-SRC-09:LEAVE-17",
          "validity": "Only the retained dated events; no inferred continuous history.",
          "value": {
            "account": "archive-u17",
            "actor": "archive-u17",
            "allowed_read_at": null,
            "archive_disabled_at": "2026-06-05T09:25:00Z",
            "central_disabled_at": "2026-06-05T09:15:00Z",
            "departed_at": "2026-06-05T09:00:00Z",
            "id": "LEAVE-17",
            "resource": "archive-prod",
            "sessions_revoked_at": "2026-06-05T09:25:00Z",
            "subject": "worker-17",
            "ticket_closed_at": "2026-06-05T09:20:00Z"
          },
          "value_hash": "14008291b56f482a93a40cad959c99f88047936b2146d56c6e9aa786c27e21de"
        }
      ],
      "records": [
        {
          "id": "6f62bb6d423e560ed45d87944f7d148d732fc65516214aca9f307b6619b2079b",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "3ac16c7193cf0a5898a20a93c0a8195ed4eb3608aad45a8c956a577aebdb88dd",
          "record_id": "ORG-03"
        },
        {
          "id": "1405c3fabc6be6d71ce355b749ab9e93fb3e1c607ced00fd172eb52fd62e85c4",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "c132a2449b8c44541ef8900052c1de390435dc8c24bb1d8e4124e0e4d1bfdae3",
          "record_id": "R-DATA"
        },
        {
          "id": "83dc9dbe272fbd62c94497e668f9d0ba831695a68329187c7b2e2687c732f7f8",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "6a7d044208ce6b8b7598f30341e54036398d636cdcbd9b86511cc4a951189d4c",
          "record_id": "INT-03"
        },
        {
          "id": "ab83c7353279dcc2361b43d73cf776136c14ea6a7590251a30f13aae61f0cb35",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "9bde415d3dfb8e18747a06ea2910066b428e63abd52f62a7c40214b50aa77bc0",
          "record_id": "C-ID-02"
        },
        {
          "id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "e0bbdc9a91a38e7ec2bfb03f37442ef25bcde3a13590e2ae16508617e18fd5a6",
          "record_id": "POP-01"
        },
        {
          "id": "7c3fceb7ffc77eb686b476631cb4838b7d79a1321e089928aac2d39bb757a96a",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "b8f52dc302637ec8575305a699ee9a0b866c211f6ea826dbab3dc861b2e1923c",
          "record_id": "LEAVE-17"
        },
        {
          "id": "37fd4ff7b050d1a9574db8590eb40fb7dccc72518d57cbeca58737b1631a2f76",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "6903037fb54dd9b68d32160c27652575690e8d1c2dedadc21a1922c618bf7849",
          "record_id": "LEAVE-24"
        },
        {
          "id": "9b302ddead3864e1c25ea5668156ae1e250ab2ca95b2d416ea660496597339fe",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "4dbe910fa844e79602250e2b502b5cf3e8a45090d9fd1c0d9eed97133819c0bb",
          "record_id": "LEAVE-33"
        },
        {
          "id": "dd6bdc3686ee8004db92eb73658f8dcab800f8b6718ffd6912ec0c4761f1dcd7",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "511f9eaaa91c4384347d99868795f41b219378d35b41b383f7596dc0d141f63e",
          "record_id": "D2-ARCH"
        },
        {
          "id": "41c1d246f8eb035da1a38a5a6a79443729b580607d17acc48113888af31a2300",
          "kind": "observation",
          "meaning": "Retained source fields; collection authority remains stipulated.",
          "passage_id": "5d76a5067525db993b46229fbfdedb76fe5028e06fa213e135213019b5fa1893",
          "record_id": "D2-ROSTER"
        },
        {
          "authority": "Fictional customer assignment, not a universal standard.",
          "hours": 4,
          "id": "249576d28ca98f44322a04811e527d808a6de0954681cfba9ebff818a6f0e99a",
          "kind": "requirement",
          "meaning": "Withdraw effective account and session access within the assigned deadline.",
          "passage_id": "9bde415d3dfb8e18747a06ea2910066b428e63abd52f62a7c40214b50aa77bc0"
        },
        {
          "assertions": {
            "claimed_status": "IT workflow complete",
            "hours": 4,
            "id": "C-ID-02",
            "requirement": "Remove central, application-local and session access within four hours of departure."
          },
          "id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047",
          "kind": "customer_claim",
          "meaning": "The customer claims its offboarding arrangement withdraws access.",
          "qualification": "Ticket closure and automation labels cannot prove their own satisfaction."
        },
        {
          "assumptions": [
            "The supplied architecture names the examined systems.",
            "Bound allowed operations can contradict recorded withdrawal."
          ],
          "id": "cca5f06ae58d5566cc99053faad8d6fb0361a8a0ccf4348af4f98fb5fb0a19d2",
          "kind": "interpretation",
          "meaning": "Dated account disablement and session revocation can establish bounded withdrawal, whether manual or automated.",
          "review_state": "reviewed_procedure_not_professional_adjudication"
        },
        {
          "id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e",
          "kind": "judgment",
          "meaning": "Remove central, application-local and session access within four hours of departure.",
          "review_state": "proposed_not_issued",
          "status": "exception",
          "uncertainty": [
            "Coverage is the declared unit and named systems, not all enterprise departures.",
            "Account activity does not identify an attacker; missing history stays unresolved."
          ]
        },
        {
          "check_id": "D2.population",
          "id": "5882c24cc720c957554ca69c46a76e5f83b3f08d537457ad173b796b377d8a4b",
          "kind": "derived_fact",
          "meaning": "Reconciled 3 unit departures against a separately originated roster.",
          "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
          "status": "supported",
          "subject": null
        },
        {
          "check_id": "D2.central",
          "id": "7a201bcec2b7c9e3df2185b12644e6581dd21031f03269ebd69f805f91f45681",
          "kind": "derived_fact",
          "meaning": "Central disablement took 15 minutes; criterion 4 hours.",
          "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
          "status": "supported",
          "subject": "LEAVE-17"
        },
        {
          "check_id": "D2.archive",
          "id": "579efb8f629d505ffa890c88c089879c49b5df850e6464189a65ab36d7a54f70",
          "kind": "derived_fact",
          "meaning": "An application withdrawal action on archive-prod occurred after the allowed deadline.",
          "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
          "status": "exception",
          "subject": "LEAVE-17"
        },
        {
          "check_id": "D2.central",
          "id": "2f336a25e5bb0132c06793e651479af863d5e9c7a6e7f5a6703b061bfbc7cfe5",
          "kind": "derived_fact",
          "meaning": "Central disablement took 10 minutes; criterion 4 hours.",
          "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
          "status": "supported",
          "subject": "LEAVE-24"
        },
        {
          "check_id": "D2.archive",
          "id": "3932302333c2d2f558b10ff3d841a8541cb4e39f488beba839eeb0a1a989f0ea",
          "kind": "derived_fact",
          "meaning": "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.",
          "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
          "status": "supported",
          "subject": "LEAVE-24"
        },
        {
          "check_id": "D2.central",
          "id": "aea3fd4582b51bfce941306e3f37bfeac9a310d8ca68dc9e02bffd7d4eaba613",
          "kind": "derived_fact",
          "meaning": "Central disablement took 12 minutes; criterion 4 hours.",
          "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
          "status": "supported",
          "subject": "LEAVE-33"
        },
        {
          "check_id": "D2.archive",
          "id": "ab19b2bdfc3e18cec009d935f22c3cf1e9ef975d0e89df58ca1b55610faa8a10",
          "kind": "derived_fact",
          "meaning": "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.",
          "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
          "status": "supported",
          "subject": "LEAVE-33"
        }
      ],
      "relations": [
        {
          "from_id": "cca5f06ae58d5566cc99053faad8d6fb0361a8a0ccf4348af4f98fb5fb0a19d2",
          "kind": "interprets",
          "reason": "Examine effective protection under the assigned deadline.",
          "to_id": "249576d28ca98f44322a04811e527d808a6de0954681cfba9ebff818a6f0e99a"
        },
        {
          "from_id": "cca5f06ae58d5566cc99053faad8d6fb0361a8a0ccf4348af4f98fb5fb0a19d2",
          "kind": "qualifies",
          "reason": "The operating arrangement label does not establish its outcome.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "cca5f06ae58d5566cc99053faad8d6fb0361a8a0ccf4348af4f98fb5fb0a19d2",
          "kind": "interprets",
          "reason": "The reviewed procedure applies this interpretation to the deciding observations.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "5882c24cc720c957554ca69c46a76e5f83b3f08d537457ad173b796b377d8a4b",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595"
        },
        {
          "from_id": "5882c24cc720c957554ca69c46a76e5f83b3f08d537457ad173b796b377d8a4b",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "41c1d246f8eb035da1a38a5a6a79443729b580607d17acc48113888af31a2300"
        },
        {
          "from_id": "5882c24cc720c957554ca69c46a76e5f83b3f08d537457ad173b796b377d8a4b",
          "kind": "supports",
          "reason": "Reconciled 3 unit departures against a separately originated roster.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "5882c24cc720c957554ca69c46a76e5f83b3f08d537457ad173b796b377d8a4b",
          "kind": "supports",
          "reason": "This check contributes its result or uncertainty; a supported part cannot erase another adverse part.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "7a201bcec2b7c9e3df2185b12644e6581dd21031f03269ebd69f805f91f45681",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "7c3fceb7ffc77eb686b476631cb4838b7d79a1321e089928aac2d39bb757a96a"
        },
        {
          "from_id": "7a201bcec2b7c9e3df2185b12644e6581dd21031f03269ebd69f805f91f45681",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "ab83c7353279dcc2361b43d73cf776136c14ea6a7590251a30f13aae61f0cb35"
        },
        {
          "from_id": "7a201bcec2b7c9e3df2185b12644e6581dd21031f03269ebd69f805f91f45681",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595"
        },
        {
          "from_id": "7a201bcec2b7c9e3df2185b12644e6581dd21031f03269ebd69f805f91f45681",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "dd6bdc3686ee8004db92eb73658f8dcab800f8b6718ffd6912ec0c4761f1dcd7"
        },
        {
          "from_id": "7a201bcec2b7c9e3df2185b12644e6581dd21031f03269ebd69f805f91f45681",
          "kind": "supports",
          "reason": "Central disablement took 15 minutes; criterion 4 hours.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "7a201bcec2b7c9e3df2185b12644e6581dd21031f03269ebd69f805f91f45681",
          "kind": "supports",
          "reason": "This check contributes its result or uncertainty; a supported part cannot erase another adverse part.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "579efb8f629d505ffa890c88c089879c49b5df850e6464189a65ab36d7a54f70",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "7c3fceb7ffc77eb686b476631cb4838b7d79a1321e089928aac2d39bb757a96a"
        },
        {
          "from_id": "579efb8f629d505ffa890c88c089879c49b5df850e6464189a65ab36d7a54f70",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "ab83c7353279dcc2361b43d73cf776136c14ea6a7590251a30f13aae61f0cb35"
        },
        {
          "from_id": "579efb8f629d505ffa890c88c089879c49b5df850e6464189a65ab36d7a54f70",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595"
        },
        {
          "from_id": "579efb8f629d505ffa890c88c089879c49b5df850e6464189a65ab36d7a54f70",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "dd6bdc3686ee8004db92eb73658f8dcab800f8b6718ffd6912ec0c4761f1dcd7"
        },
        {
          "from_id": "579efb8f629d505ffa890c88c089879c49b5df850e6464189a65ab36d7a54f70",
          "kind": "contradicts",
          "reason": "An application withdrawal action on archive-prod occurred after the allowed deadline.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "579efb8f629d505ffa890c88c089879c49b5df850e6464189a65ab36d7a54f70",
          "kind": "supports",
          "reason": "This check contributes its result or uncertainty; a supported part cannot erase another adverse part.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "2f336a25e5bb0132c06793e651479af863d5e9c7a6e7f5a6703b061bfbc7cfe5",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "37fd4ff7b050d1a9574db8590eb40fb7dccc72518d57cbeca58737b1631a2f76"
        },
        {
          "from_id": "2f336a25e5bb0132c06793e651479af863d5e9c7a6e7f5a6703b061bfbc7cfe5",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "ab83c7353279dcc2361b43d73cf776136c14ea6a7590251a30f13aae61f0cb35"
        },
        {
          "from_id": "2f336a25e5bb0132c06793e651479af863d5e9c7a6e7f5a6703b061bfbc7cfe5",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595"
        },
        {
          "from_id": "2f336a25e5bb0132c06793e651479af863d5e9c7a6e7f5a6703b061bfbc7cfe5",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "dd6bdc3686ee8004db92eb73658f8dcab800f8b6718ffd6912ec0c4761f1dcd7"
        },
        {
          "from_id": "2f336a25e5bb0132c06793e651479af863d5e9c7a6e7f5a6703b061bfbc7cfe5",
          "kind": "supports",
          "reason": "Central disablement took 10 minutes; criterion 4 hours.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "2f336a25e5bb0132c06793e651479af863d5e9c7a6e7f5a6703b061bfbc7cfe5",
          "kind": "supports",
          "reason": "This check contributes its result or uncertainty; a supported part cannot erase another adverse part.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "3932302333c2d2f558b10ff3d841a8541cb4e39f488beba839eeb0a1a989f0ea",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "37fd4ff7b050d1a9574db8590eb40fb7dccc72518d57cbeca58737b1631a2f76"
        },
        {
          "from_id": "3932302333c2d2f558b10ff3d841a8541cb4e39f488beba839eeb0a1a989f0ea",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "ab83c7353279dcc2361b43d73cf776136c14ea6a7590251a30f13aae61f0cb35"
        },
        {
          "from_id": "3932302333c2d2f558b10ff3d841a8541cb4e39f488beba839eeb0a1a989f0ea",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595"
        },
        {
          "from_id": "3932302333c2d2f558b10ff3d841a8541cb4e39f488beba839eeb0a1a989f0ea",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "dd6bdc3686ee8004db92eb73658f8dcab800f8b6718ffd6912ec0c4761f1dcd7"
        },
        {
          "from_id": "3932302333c2d2f558b10ff3d841a8541cb4e39f488beba839eeb0a1a989f0ea",
          "kind": "supports",
          "reason": "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "3932302333c2d2f558b10ff3d841a8541cb4e39f488beba839eeb0a1a989f0ea",
          "kind": "supports",
          "reason": "This check contributes its result or uncertainty; a supported part cannot erase another adverse part.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "aea3fd4582b51bfce941306e3f37bfeac9a310d8ca68dc9e02bffd7d4eaba613",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "9b302ddead3864e1c25ea5668156ae1e250ab2ca95b2d416ea660496597339fe"
        },
        {
          "from_id": "aea3fd4582b51bfce941306e3f37bfeac9a310d8ca68dc9e02bffd7d4eaba613",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "ab83c7353279dcc2361b43d73cf776136c14ea6a7590251a30f13aae61f0cb35"
        },
        {
          "from_id": "aea3fd4582b51bfce941306e3f37bfeac9a310d8ca68dc9e02bffd7d4eaba613",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595"
        },
        {
          "from_id": "aea3fd4582b51bfce941306e3f37bfeac9a310d8ca68dc9e02bffd7d4eaba613",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "dd6bdc3686ee8004db92eb73658f8dcab800f8b6718ffd6912ec0c4761f1dcd7"
        },
        {
          "from_id": "aea3fd4582b51bfce941306e3f37bfeac9a310d8ca68dc9e02bffd7d4eaba613",
          "kind": "supports",
          "reason": "Central disablement took 12 minutes; criterion 4 hours.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "aea3fd4582b51bfce941306e3f37bfeac9a310d8ca68dc9e02bffd7d4eaba613",
          "kind": "supports",
          "reason": "This check contributes its result or uncertainty; a supported part cannot erase another adverse part.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "ab19b2bdfc3e18cec009d935f22c3cf1e9ef975d0e89df58ca1b55610faa8a10",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "9b302ddead3864e1c25ea5668156ae1e250ab2ca95b2d416ea660496597339fe"
        },
        {
          "from_id": "ab19b2bdfc3e18cec009d935f22c3cf1e9ef975d0e89df58ca1b55610faa8a10",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "ab83c7353279dcc2361b43d73cf776136c14ea6a7590251a30f13aae61f0cb35"
        },
        {
          "from_id": "ab19b2bdfc3e18cec009d935f22c3cf1e9ef975d0e89df58ca1b55610faa8a10",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "29600ab1cc3e395c6c591702f0e0cd817a4579049ea0c1e32ba33d90b3e30595"
        },
        {
          "from_id": "ab19b2bdfc3e18cec009d935f22c3cf1e9ef975d0e89df58ca1b55610faa8a10",
          "kind": "derived_from",
          "reason": "The procedure uses these retained fields under its explicit assumptions.",
          "to_id": "dd6bdc3686ee8004db92eb73658f8dcab800f8b6718ffd6912ec0c4761f1dcd7"
        },
        {
          "from_id": "ab19b2bdfc3e18cec009d935f22c3cf1e9ef975d0e89df58ca1b55610faa8a10",
          "kind": "supports",
          "reason": "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.",
          "to_id": "c6ebbe1b186a9831767b32c488ec84b9caff61a2d599baa209d88b97aa607047"
        },
        {
          "from_id": "ab19b2bdfc3e18cec009d935f22c3cf1e9ef975d0e89df58ca1b55610faa8a10",
          "kind": "supports",
          "reason": "This check contributes its result or uncertainty; a supported part cannot erase another adverse part.",
          "to_id": "fa601065aae442035c171bdf9f0310231e805c112ea04c6cbcd4ae1a14da553e"
        },
        {
          "from_id": "b8f52dc302637ec8575305a699ee9a0b866c211f6ea826dbab3dc861b2e1923c",
          "kind": "supersedes",
          "reason": "Locally supplied fictional source correction; authenticity is not independently established.",
          "to_id": "90763f5784ae42badc53d323dfc70995345f09ed2973d566a96faa7f1883cbf4"
        }
      ],
      "scope": {
        "assumptions": [
          "Supplied system inventory bounds this unit; omitted enterprise systems are not examined.",
          "Fictional source authority is stipulated, not independently authenticated."
        ],
        "period": {
          "end": "2026-07-01T00:00:00Z",
          "start": "2026-06-01T00:00:00Z"
        },
        "population": [
          "worker-17",
          "worker-24",
          "worker-33"
        ],
        "population_reconciled": true,
        "reachable_scope": [
          "Retained customer exports"
        ],
        "systems": [
          "archive-prod"
        ]
      },
      "version": "d2-evidence/1"
    },
    "evidence_refs": [
      "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
      "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-HR:D2-ROSTER",
      "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
      "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
      "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH",
      "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-24",
      "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-33",
      "case-a31e38ea14a0:c41c949f2397d834:SRC-02:R-DATA",
      "case-a31e38ea14a0:c41c949f2397d834:SRC-01:ORG-03",
      "case-a31e38ea14a0:c41c949f2397d834:SRC-04:INT-03"
    ],
    "hold_ids": [
      "challenge-baa8f97d8565"
    ],
    "id": "D2",
    "judgment": {
      "alternative": "Manual withdrawal is valid when dated account and session evidence demonstrates the same requirement. Automation alone does not establish protection.",
      "basis_id": "e7830fa6e02d8dbc74c31134a6358c1156af1b1a94d803b32db83cb352ec35c0",
      "branch": "D2/change",
      "claim": "Remove central, application-local and session access within four hours of departure.",
      "deciding_check_ids": [
        "D2.archive"
      ],
      "deciding_checks": [
        "LEAVE-17 archive"
      ],
      "evidence_refs": [
        "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
        "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-HR:D2-ROSTER",
        "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
        "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
        "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH",
        "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-24",
        "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-33",
        "case-a31e38ea14a0:c41c949f2397d834:SRC-02:R-DATA",
        "case-a31e38ea14a0:c41c949f2397d834:SRC-01:ORG-03",
        "case-a31e38ea14a0:c41c949f2397d834:SRC-04:INT-03"
      ],
      "existing_protection": [
        "Reconciled 3 unit departures against a separately originated roster.",
        "Central disablement took 15 minutes; criterion 4 hours.",
        "Central disablement took 10 minutes; criterion 4 hours.",
        "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.",
        "Central disablement took 12 minutes; criterion 4 hours.",
        "Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement."
      ],
      "handoff": "The named owner must confirm the next step. Management owns implementation and risk acceptance; this recommendation grants no execution authority.",
      "limits": [
        "Coverage is the declared unit and named systems, not all enterprise departures.",
        "Account activity does not identify an attacker; missing history stays unresolved."
      ],
      "method_hash": "b42fe8610864f3ad3510dae79d879d8a92c82740547774ea287edfb3a18391b1",
      "patterns": [
        "J01",
        "J02",
        "J03",
        "J04",
        "J05",
        "J06"
      ],
      "period": {
        "end": "2026-07-01T00:00:00Z",
        "start": "2026-06-01T00:00:00Z"
      },
      "planning_reason": "Reconcile departures, then examine account and session withdrawal and surviving operations for archive-prod (automated). Automation and ticket closure do not establish completed withdrawal.",
      "reconsider_when": "Reconsider when a system, departure, session route, dated operation or roster changes. A closed ticket cannot override surviving access.",
      "status": "Development proposal; not founder-qualified",
      "version": "judgment-proposals/1.0"
    },
    "limits": [
      "Coverage is the declared unit and named systems, not all enterprise departures.",
      "Account activity does not identify an attacker; missing history stays unresolved."
    ],
    "positions": [
      {
        "basis": "held from LEAVE-17 central, LEAVE-24 central, LEAVE-33 central: the population is not reconciled against a separately originated roster, so firm",
        "check_ids": [
          "D2.central",
          "D2.central",
          "D2.central"
        ],
        "check_refs": [
          {
            "check_id": "D2.central",
            "subject_id": "LEAVE-17"
          },
          {
            "check_id": "D2.central",
            "subject_id": "LEAVE-24"
          },
          {
            "check_id": "D2.central",
            "subject_id": "LEAVE-33"
          }
        ],
        "confidence": "firm",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-24",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-33"
        ],
        "id": "CTL-042",
        "labels": [
          "LEAVE-17 central",
          "LEAVE-24 central",
          "LEAVE-33 central"
        ],
        "part": null,
        "position": "central account disablement completed within the customer's deadline for every departure in the unit",
        "record_ids": [
          "LEAVE-17",
          "POP-01",
          "D2-ARCH",
          "LEAVE-24",
          "LEAVE-33"
        ],
        "scenario": "D2",
        "status": "held"
      },
      {
        "basis": "broke from LEAVE-17 archive, LEAVE-24 archive, LEAVE-33 archive: the population is not reconciled against a separately originated roster, so firm",
        "check_ids": [
          "D2.archive",
          "D2.archive",
          "D2.archive"
        ],
        "check_refs": [
          {
            "check_id": "D2.archive",
            "subject_id": "LEAVE-17"
          },
          {
            "check_id": "D2.archive",
            "subject_id": "LEAVE-24"
          },
          {
            "check_id": "D2.archive",
            "subject_id": "LEAVE-33"
          }
        ],
        "confidence": "firm",
        "evidence_refs": [
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-24",
          "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-33"
        ],
        "id": "CTL-018",
        "labels": [
          "LEAVE-17 archive",
          "LEAVE-24 archive",
          "LEAVE-33 archive"
        ],
        "part": null,
        "position": "application account and sessions were withdrawn within the customer's deadline for every departure in the unit",
        "record_ids": [
          "LEAVE-17",
          "POP-01",
          "D2-ARCH",
          "LEAVE-24",
          "LEAVE-33"
        ],
        "scenario": "D2",
        "status": "broke"
      }
    ],
    "recommendation": "Have the application owner close the demonstrated surviving access or late withdrawal. Ticket closure does not establish access removal.",
    "record_ids": [
      "POP-01",
      "D2-ROSTER",
      "LEAVE-17",
      "C-ID-02",
      "D2-ARCH",
      "LEAVE-24",
      "LEAVE-33",
      "R-DATA",
      "ORG-03",
      "INT-03"
    ],
    "response": {
      "actions": [
        {
          "evidence_refs": [
            "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:LEAVE-17",
            "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-03:C-ID-02",
            "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-09:POP-01",
            "case-a31e38ea14a0:c41c949f2397d834:CAPTURE-SRC-D2-ARCH:D2-ARCH"
          ],
          "kind": "change",
          "record_ids": [
            "LEAVE-17",
            "C-ID-02",
            "POP-01",
            "D2-ARCH"
          ],
          "text": "Have the application owner close the demonstrated surviving access or late withdrawal. Ticket closure does not establish access removal."
        }
      ],
      "kind": "change",
      "owner": "Customer operations",
      "owner_evidence_refs": [
        "case-a31e38ea14a0:c41c949f2397d834:SRC-01:ORG-03"
      ],
      "owner_record_ids": [
        "ORG-03"
      ],
      "owner_status": "Customer record; handoff not yet accepted",
      "why": "An application withdrawal action on archive-prod occurred after the allowed deadline."
    },
    "review_status": "held",
    "risk_id": "R-DATA",
    "status": "exception",
    "title": "Did offboarding reach every sensitive-data system?"
  }
}